MikroTik known exploited vulnerabilities
CISA's Known Exploited Vulnerabilities catalog lists 5 MikroTik vulnerabilities: 3 added in the last 365 days, 3 rated critical (CVSS 9 or higher), and 0 with known ransomware use. The most recent was added Sep 25, 2026.
RSS feed for MikroTik exploited vulnerabilities · Search them on KEVWire · Ask your AI assistant
| Added to KEV | CVE | Vulnerability | CVSS | EPSS | Federal due date | Ransomware use |
|---|---|---|---|---|---|---|
| 2026-09-25 | CVE-2026-67279 | Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability | 6.9 (v4.0) | 2.3% | 2026-09-28 | Unknown |
| 2026-09-10 | CVE-2026-67277 | MikroTik RouterOS Missing Authentication for Critical Function Vulnerability | 8.8 (v4.0) | 1.6% | 2026-09-13 | Unknown |
| 2026-09-10 | CVE-2026-86060 | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability | 9.2 (v4.0) | 6.4% | 2026-09-13 | Unknown |
| 2022-09-08 | CVE-2018-7445 | MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability | 9.8 (v3.1) | 65.8% | 2022-09-29 | Unknown |
| 2021-12-01 | CVE-2018-14847 | MikroTik Router OS Directory Traversal Vulnerability | 9.1 (v3.1) | 96.0% | 2022-06-01 | Unknown |